[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	10780
Summary	IPv6 Conversation List Includes Conversations Not Present In Capture File
Product	Wireshark
Version	1.12.2
Hardware	x86-64
OS	Linux (other)
Status	UNCONFIRMED
Severity	Major
Priority	Low
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	tom@qacafe.com

Created attachment 13325 [details]
Capture with incorrect IPv6 Conversations

Build Information:
$ tshark -v
TShark 1.12.2 (Git Rev Unknown from unknown)

Copyright 1998-2014 Gerald Combs <gerald@wireshark.org> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GLib 2.36.3, with libpcap, without libz, without POSIX
capabilities, without libnl, without SMI, without c-ares, without ADNS, without
Lua, without Python, without GnuTLS, without Gcrypt, without Kerberos, without
GeoIP.

Running on Linux 3.10.0-123.8.1.el7.x86_64, with locale en_US.UTF-8, with
libpcap version 1.5.3.
      Intel(R) Core(TM) i7-3615QM CPU @ 2.30GHz

Built using gcc 4.8.2 20140120 (Red Hat 4.8.2-16).
--
The OS I am using is CentOS 7.0.

When I use tshark to view the IPv6 Conversation List it is listing
conversations that were not present in the capture file. The IPv6 Addresses it
prints for the conversations were also not present in the Capture file and
these addresses change each time I run the command.

I've attached a capture named "ipv6_conversations_with_tcp_reassembly.pcapng"
which exhibits this behavior. I have also noticed that the
tcp.desgement_tcp_streams preference can effect the output as well. When this
is set to TRUE, there are two extra conversations found in the attached file.
When this is set to FALSE there is only one extra conversation found.

Here is the tshark output I am receiving when listing the IPv6 Conversations.
In both cases only the first conversation listed is correct:

$ tshark -r ipv6_conversations_with_tcp_reassembly.pcapng -q -z conv,ipv6 -o
tcp.desegment_tcp_streams:FALSE
================================================================================
IPv6 Conversations
Filter:<No Filter>
                                               |       <-      | |       ->    
 | |     Total     |    Relative    |   Duration   |
                                               | Frames  Bytes | | Frames 
Bytes | | Frames  Bytes |      Start     |              |
fe80::7a4b:87ff:fe0b:51d6 <-> 2002:4adc:e543:1:a00:27ff:fedd:9e13     116   
164641      90     11466     206    176107     0.000276000         0.5940
c0:180d:c47f:0:a00:27ff:fedd:9e13 <-> ::100:0:fe0b:51d6          1        94   
   0         0       1        94     0.000000000         0.0000
================================================================================

$ tshark -r ipv6_conversations_with_tcp_reassembly.pcapng -q -z conv,ipv6 -o
tcp.desegment_tcp_streams:TRUE
================================================================================
IPv6 Conversations
Filter:<No Filter>
                                               |       <-      | |       ->    
 | |     Total     |    Relative    |   Duration   |
                                               | Frames  Bytes | | Frames 
Bytes | | Frames  Bytes |      Start     |              |
fe80::7a4b:87ff:fe0b:51d6 <-> 2002:4adc:e543:1:a00:27ff:fedd:9e13     115   
163127      90     11466     205    174593     0.000276000         0.5940
50:149b:ea7f:0:7a4b:87ff:fe0b:51d6 <-> ::100:0:fedd:9e13          1      1514  
    0         0       1      1514     0.212604000         0.0000
50:149b:ea7f:0:a00:27ff:fedd:9e13 <-> ::100:0:fe0b:51d6          1        94   
   0         0       1        94     0.000000000         0.0000
================================================================================

If there is any extra information or anything I can do to help just let me
know.

Thank you!

---

      You are receiving this mail because:

• You are watching all bug changes.